Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my kern.log flooded by these lines:

Jan  4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=33285 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:01:09 myhost kernel: [9040613.699425] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=62996 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:01:21 myhost kernel: [9040625.584770] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=26121 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:01:33 myhost kernel: [9040637.471088] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=59140 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:01:45 myhost kernel: [9040649.352450] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=33805 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:01:56 myhost kernel: [9040661.237910] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=33285 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:02:08 myhost kernel: [9040673.116958] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=14341 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:02:20 myhost kernel: [9040685.003337] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=22793 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:02:32 myhost kernel: [9040696.886561] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=32783 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:02:44 myhost kernel: [9040708.770251] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=14854 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:02:56 myhost kernel: [9040720.652454] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=56844 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:03:08 myhost kernel: [9040732.530823] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=4373 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:03:20 myhost kernel: [9040744.409373] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=62989 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:03:32 myhost kernel: [9040756.417865] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=4116 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:03:44 myhost kernel: [9040769.008748] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=16136 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:03:57 myhost kernel: [9040782.192103] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=9476 PROTO=UDP SPT=25345 DPT=53 LEN=44 
Jan  4 03:04:10 myhost kernel: [9040795.020864] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 DST=xx.xx.xx.xx LEN=64 TOS=0x00 PREC=0x00 TTL=236 ID=55553 PROTO=UDP SPT=25345 DPT=53 LEN=44 

Is this a DoS attack? Of course xx.xx.xx.xx is my IP address (destination).

EDIT: I have a lot of requests from other IPs too, same port though.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

No, it's not a DDoS, and it's not even obvious that it's any kind of attack at all.

What it is, is a single IP address attempting to contact UDP port 53 on your server. This is the port used by DNS.

Most likely you have recently moved into this server and just got this IP address, and some previous user of the IP address had a DNS server on it.

Since you aren't running a DNS server, you can safely ignore it.

share|improve this answer
    
I added a note that also other IPs are targeting the same port. 6 MB of file log for 3 days. And anyway it's strange.. I have this IP from june! –  MultiformeIngegno Jan 4 '13 at 2:14
    
Feel free to edit your question, then. If you have significantly large logs, put them in a pastebin and link to it. –  Michael Hampton Jan 4 '13 at 2:15
    
Thanks! :) Here's my whole kern.log (too big for pastebin): lorenzoraffio.com/altro/kern_edited.txt –  MultiformeIngegno Jan 4 '13 at 2:28
    
There are maybe half a dozen unique addresses involved here. So I still don't see any cause for concern. –  Michael Hampton Jan 4 '13 at 2:55
add comment

Based on the information you've given it's not possible to tell if this is a DOS or not. But it could be a DNS amplification attack.

A packet capture would be able to shed some light on that. But if it's only 6MB of logs for 3 days I'm going to say that this is unlikely.

share|improve this answer
add comment

THIS IS an DDoS attack, but you are an attacker! (well, almost, because of good iptables rule) To bo more precise, this way you are cooperating with individuals which are attackig host 178.33.217.13. This IP is not an attacker, but this is a victim flooded by answers for dns queries with spoofed IP. In other words, you could answer this way to a host which is not asking you about anything. The good thing is, your firewall is blocking this attack. I'm sure, this is DNS amplification attack.

share|improve this answer
    
How can you tell the source is spoofed? –  krugger Apr 17 '13 at 17:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.